Restrict the ability to set SELinux enforcing mode to init.

Also make su and shell permissive in non-user builds to allow
use of setenforce without violating the neverallow rule.

Change-Id: Ie76ee04e90d5a76dfaa5f56e9e3eb7e283328a3f
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

1 files changed, 3 insertions, 0 deletions

diff --git a/su.te b/su.te
index b68536c..dda7708 100644
--- a/su.te
+++ b/su.te
@@ -4,3 +4,6 @@ domain_auto_trans(shell, su_exec, su)
 
 # su is unconfined.
 unconfined_domain(su)
+
+# su is also permissive to permit setenforce.
+permissive su;